Facebook, Instagram Face Ruling that can end targeted ads
European Union privacy regulators have ruled that Meta, the parent company of Facebook and Instagram, cannot make giving up data for targeted ads a condition of joining the social network, according to reports published Tuesday in The Wall Street Journal and Reuters. The decision threatens to overturn the social media giant’s business model and change the financial foundations of the internet.
Registering on Facebook or Instagram means clicking past a privacy policy and consenting to the social networks’ digital surveillance for advertising purposes. If you do not agree, you cannot have an account. But the European Data Protection Board (EDPB), which is made up of all of Europe’s privacy regulators, issued a series of new rulings on Monday that reportedly declared that this type of forced consent violates General Data Protection Regulation (GDPR)The EU’s comprehensive privacy law.
The EDPB confirmed that it had reached a binding decision on the legality of data collection on Facebook, Instagram and WhatsApp in a press release, but has not made public the contents of the ruling. However, key details were leaked to the press on Tuesday.
The decision would not only affect Meta. Every company that serves targeted ads works in much the same way as the social media giant. You can sometimes opt-out of data from other parts of the internet being used for social media advertising, but the new ruling seeks to limit businesses from using the data they collect on their own networks. It would be a change to how privacy works online.
“The EU regulators’ decision, if upheld, will have a dramatic impact on Meta’s revenues in Europe, crippling their ability to use information about users’ activities on the platform to sell targeted advertising,” said Debra Aho Williamson. a principal analyst at Insider Intelligence, in an email. “But we expect Meta to fight hard to defend its business, and it could be months, if not years, before any impact is really felt.”
Meta did not respond to a request for comment on the ruling.
The ruling does not immediately force Meta to change its practice. Instead, it is calling on Ireland’s Data Protection Commission to issue specific orders within a month, which are likely to include significant fines, Reuters reported. Meta is also likely to appeal the decision, which could allow the status quo to continue during litigation.
But depending on how the ruling plays out, it could mean that Meta and other companies it owns will have to obtain real, informed consent before chewing up all your personal information and spitting out ads. What would it look like? It is not clear yet.
When people are presented with a choice of whether to be tracked online (and still use a given website or app), they tend to say no. Over the past year, Apple has launched a privacy setting that makes apps ask for permission before tracking users, “Ask the app not to track.” The vast majority say no, and Meta’s business took a nose dive as a result—the company said it lost $10 billion thanks to Apple’s privacy policy alone. An EU judgment against Meta could mean a financial crisis for the company, whose share price has already fallen like a stone this year. Meta’s stock was down 6.79% at the close on Tuesday following the news.
But the ruling is probably far greater than Meta. Many other companies, from Google to TikTok to smaller players, operate via a similar legal model: consent to targeted additions or use another platform. It is unclear how widely the EU decision will apply across the continent, but it is possible that one of the fundamental models of online business could be disrupted.
The open secret of the tech industry is that many companies, apps and websites haven’t come up with a way to make money apart from harvesting data and targeting ads. If the company can’t use your data, they can still show you “contextual” ads, which are based on the content you’re viewing (think an ad for Honda in an article about cars). But contextual advertising is cheaper than ads tailored via your personal information, and therefore less profitable for the company’s sales.
An EU decision only has a direct effect on businesses operating in the EU, but it is a sign that governments may finally be changing their tune when it comes to privacy. So far, lawmakers have been willing to pass privacy rules that make certain data practices more burdensome for the business world, but this is the first time a major government body has taken steps to limit targeted ads outright.
But GDPR serves as a model for privacy laws in the US and around the world. If this strict interpretation of the law is successful—however you define success—it could portend a far more private future.
Update 12/07/21, 12:05 PM ET: This story has been updated with details of a press release from the European Data Protection Board.